Implementing User Authentication with Firebase Auth

Course: Android App Development

Topic: Implementing User Authentication with Firebase Auth

Course Link: Android App Development Course

Demo Link: Register for a Free Course Demo

Website: JustAcademy

1. Introduction to Firebase Authentication

Firebase Authentication is a backend authentication service provided by Google Firebase. It allows Android developers to authenticate users securely without building an entire authentication system from scratch. It supports email and password authentication, phone number verification, Google sign-in, and several other identity providers.

Authentication is an essential part of modern Android applications because many applications need to identify users before allowing them to access personalized information, private content, or account-specific features.

Firebase Authentication manages important authentication operations, such as creating accounts, signing users in, maintaining authentication sessions, and signing users out. Developers can integrate it with Android applications using the Firebase SDK.

Why Is Firebase Authentication Important?

• It simplifies user registration and login functionality.
• It reduces the need to implement password storage and authentication infrastructure manually.
• It supports multiple authentication providers.
• It provides authentication state information to Android applications.
• It integrates with Firebase services such as Cloud Firestore and Realtime Database.
• It supports account recovery and email verification workflows.
• It helps developers build scalable applications with managed authentication services.

2. Learning Objectives

After completing this topic, learners should be able to:

• Understand Firebase Authentication and its role in Android development.
• Create a Firebase project and connect it to an Android application.
• Configure Firebase Authentication providers.
• Implement email and password registration.
• Implement user login and logout functionality.
• Observe authentication state changes.
• Handle authentication errors and validate user input.
• Implement email verification and password recovery workflows.
• Protect user data with appropriate authorization rules.
• Test authentication functionality and apply security best practices.

3. Understanding Authentication and Authorization

Authentication and authorization are related concepts, but they perform different jobs in an application.

Firebase Authentication primarily handles identity and sign-in state. Access to databases, files, and backend operations must also be protected using security rules or server-side authorization.

4. How Firebase Authentication Works

A typical email and password authentication workflow involves the following steps:

1. The developer creates a Firebase project and registers the Android application.
2. The Firebase Authentication service is enabled in the Firebase Console.
3. The application displays registration and login screens.
4. The user enters their credentials.
5. The application validates the input and sends the authentication request through the Firebase SDK.
6. Firebase processes the request and returns a success result or an authentication error.
7. The application observes the authenticated user state.
8. The application navigates to the appropriate screen based on the result.
9. Protected data is accessed only when the relevant authorization rules permit it.

Authentication Flow

User
  |
  v
Android Login or Registration Screen
  |
  v
Input Validation
  |
  v
Firebase Authentication SDK
  |
  v
Firebase Authentication Service
  |
  +------ Authentication Failed
  |             |
  |             v
  |       Display Error Message
  |
  +------ Authentication Successful
                |
                v
        Authenticated User State
                |
                v
       Authorized App Features

5. Prerequisites for Integration

Before integrating Firebase Authentication into an Android application, ensure that the following requirements are met:

• Android Studio is installed and configured.
• An Android project has been created.
• The application has a valid application ID or package name.
• A Google account is available to access Firebase Console.
• The application has internet access when communicating with Firebase.
• The Firebase Android configuration file is available.
• The developer understands basic Kotlin or Java programming.
• The project uses compatible Android Gradle Plugin, Gradle, and Firebase dependency versions.

6. Creating a Firebase Project

The first step is to create a Firebase project and register the Android application.

Step 1: Open Firebase Console

Visit Firebase Console and sign in with your Google account.

Step 2: Create a Project

1. Click the option to create a Firebase project.
2. Enter a suitable project name, such as MyAndroidAuthApp.
3. Follow the setup instructions and complete project creation.
4. Enable Google Analytics only if required by the project.

Step 3: Register the Android Application

1. Select the Android platform from the Firebase project overview.
2. Enter the exact application ID used by the Android project.
3. Optionally provide a recognizable app nickname.
4. Register the application.

The Android package name must match the application ID configured in the Android project. If the application uses different IDs for development and production, register the appropriate Firebase Android applications separately.

Step 4: Download the Configuration File

Download the google-services.json file from Firebase Console and place it in the Android application's app module directory, usually named app/.

MyAndroidAuthApp/
├── app/
│   ├── google-services.json
│   ├── build.gradle.kts
│   └── src/
├── build.gradle.kts
└── settings.gradle.kts

The configuration file contains Firebase project and application identifiers. It is not a substitute for access control. Sensitive backend credentials and service account keys must never be embedded in an Android application.

7. Enabling Email and Password Authentication

Firebase Authentication supports multiple sign-in methods. In this lesson, email and password authentication will be used as the primary example.

1. Open your project in Firebase Console.
2. Navigate to Authentication.
3. Open the sign-in method or sign-in providers section.
4. Select Email/Password.
5. Enable the email and password provider.
6. Save the changes.

Without enabling the relevant provider, registration and login requests using that method will fail.

8. Adding Firebase Authentication Dependencies

Firebase dependencies must be added to the Android project before the authentication SDK can be used.

Using the Firebase BoM with Gradle Kotlin DSL

In the project-level Gradle configuration, ensure that the Google Services plugin is declared using a compatible version. A typical configuration is shown below; use the current version recommended by Firebase for your project.

// Project-level build.gradle.kts
plugins {
    id("com.google.gms.google-services") version "4.4.4" apply false
}

In the app-level build.gradle.kts file, apply the plugin and add the Firebase Authentication dependency.

// app/build.gradle.kts
plugins {
    id("com.android.application")
    id("org.jetbrains.kotlin.android")
    id("com.google.gms.google-services")
}

dependencies {
    implementation(platform("com.google.firebase:firebase-bom:34.5.0"))
    implementation("com.google.firebase:firebase-auth")
}

The versions above are illustrative configuration examples. Check the official Firebase setup instructions for current compatible versions and adapt the plugins to the Gradle configuration used by your project. Firebase BoM manages compatible Firebase library versions, so individual Firebase dependencies generally do not need separate version numbers.

After updating the Gradle files, synchronize the project and resolve any compatibility errors before continuing.

Official reference: Firebase setup for Android.

9. Initializing Firebase Authentication

After adding the dependencies, obtain a Firebase Authentication instance in the relevant Activity, ViewModel, or repository. In Kotlin, the basic initialization is straightforward.

import com.google.firebase.auth.FirebaseAuth

class AuthRepository {

    private val auth: FirebaseAuth =
        FirebaseAuth.getInstance()

    fun getCurrentUser() = auth.currentUser
}

FirebaseAuth.getInstance() returns the authentication instance associated with the configured Firebase application. The current user may be null when no user is signed in.

10. Designing the Registration Screen

A registration screen typically collects an email address, a password, and optionally a password confirmation. It may also include a link to the login screen and a button to create the account.

Recommended UI Components

For a production application, use a clear layout, appropriate input types, accessible labels, and a design that works across different screen sizes.

11. Implementing User Registration with Kotlin

Firebase provides the createUserWithEmailAndPassword() method to register a user with an email address and password.

import com.google.firebase.auth.FirebaseAuth

class RegistrationHelper(
    private val auth: FirebaseAuth =
        FirebaseAuth.getInstance()
) {

    fun registerUser(
        email: String,
        password: String,
        onResult: (Boolean, String) -> Unit
    ) {
        val cleanEmail = email.trim()

        if (cleanEmail.isBlank() || password.isBlank()) {
            onResult(false, "Email and password are required.")
            return
        }

        auth.createUserWithEmailAndPassword(
            cleanEmail,
            password
        ).addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(true, "Account created successfully.")
            } else {
                onResult(
                    false,
                    task.exception?.localizedMessage
                        ?: "Registration failed."
                )
            }
        }
    }
}

Explanation

• FirebaseAuth.getInstance() obtains the authentication service instance.
• trim() removes unnecessary whitespace around the email address.
• The blank-field check prevents obviously incomplete requests.
• createUserWithEmailAndPassword() submits the registration request.
• addOnCompleteListener() handles the asynchronous result.
• task.isSuccessful indicates whether the operation succeeded.
• The callback communicates the result to the calling UI layer.

This example demonstrates the authentication operation. In a larger application, keep business logic in a repository or ViewModel and represent loading, success, and failure using observable UI state rather than coupling the authentication layer directly to Activity navigation.

12. Implementing User Login

Registered users can sign in using signInWithEmailAndPassword(). Firebase validates the credentials and updates the authentication state when sign-in succeeds.

import com.google.firebase.auth.FirebaseAuth

class LoginHelper(
    private val auth: FirebaseAuth =
        FirebaseAuth.getInstance()
) {

    fun loginUser(
        email: String,
        password: String,
        onResult: (Boolean, String) -> Unit
    ) {
        val cleanEmail = email.trim()

        if (cleanEmail.isBlank() || password.isBlank()) {
            onResult(false, "Enter your email and password.")
            return
        }

        auth.signInWithEmailAndPassword(
            cleanEmail,
            password
        ).addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(true, "Login successful.")
            } else {
                onResult(
                    false,
                    task.exception?.localizedMessage
                        ?: "Unable to sign in."
                )
            }
        }
    }
}

Login Implementation Details

1. Collect the email address and password.
2. Validate that both fields contain values.
3. Call the Firebase sign-in method.
4. Wait for the asynchronous operation to complete.
5. Display a suitable error if authentication fails.
6. On success, observe the authenticated user and navigate to the appropriate screen.

Avoid displaying unnecessarily detailed authentication errors to end users. Depending on the configured security policy, a generic message may be preferable to prevent account enumeration.

13. Checking the Currently Authenticated User

The currentUser property returns the currently signed-in Firebase user, or null when no authenticated user is available.

import com.google.firebase.auth.FirebaseAuth

fun checkAuthenticationStatus() {
    val auth = FirebaseAuth.getInstance()
    val user = auth.currentUser

    if (user != null) {
        val uid = user.uid
        val email = user.email

        println("Authenticated user ID: $uid")
        println("Authenticated email: $email")
    } else {
        println("No authenticated user.")
    }
}

The Firebase user ID, or UID, is a stable identifier for the account within the Firebase project. It is commonly used to associate a profile document with its owner. Do not treat the email address or a locally stored value as proof of authorization.

14. Observing Authentication State Changes

An authentication state listener helps an application react when a user signs in, signs out, or the authenticated user changes. This is useful for deciding whether to display a login screen or a signed-in screen.

import com.google.firebase.auth.FirebaseAuth
import com.google.firebase.auth.FirebaseUser

class AuthenticationStateObserver {

    private val auth = FirebaseAuth.getInstance()

    private val listener =
        FirebaseAuth.AuthStateListener { firebaseAuth ->
            val user: FirebaseUser? = firebaseAuth.currentUser

            if (user != null) {
                println("User is signed in: ${user.uid}")
            } else {
                println("User is signed out.")
            }
        }

    fun startObserving() {
        auth.addAuthStateListener(listener)
    }

    fun stopObserving() {
        auth.removeAuthStateListener(listener)
    }
}

Why Is the Listener Useful?

• It helps update the application UI when the authentication state changes.
• It supports login and logout navigation.
• It reduces the need to repeatedly check authentication manually.
• It helps handle restored authentication sessions.

Register and remove listeners according to the lifecycle of the component that owns them. For a production MVVM application, authentication state can be exposed as a Flow or another observable state source so the UI can react without directly managing listeners.

15. Implementing Logout Functionality

Signing out removes the current local Firebase Authentication session from the application. It does not delete the user's account or automatically delete the user's database records.

import com.google.firebase.auth.FirebaseAuth

fun logoutUser() {
    FirebaseAuth.getInstance().signOut()
}

Logout Workflow

1. The user selects the logout option.
2. The application calls signOut().
3. The authentication state listener detects the change.
4. The application navigates to the login or welcome screen.
5. Navigation should clear or replace protected screens so the user cannot return to them using the Back button.

When using Google Sign-In or another identity provider, sign-out may also need to be performed through that provider's SDK, depending on the intended account-switching experience.

16. Sending Email Verification

Email verification helps confirm that the user can access the email address associated with an account. Firebase Authentication provides a method for sending a verification email to the currently signed-in user.

import com.google.firebase.auth.FirebaseAuth

fun sendVerificationEmail(
    onResult: (Boolean, String) -> Unit
) {
    val user = FirebaseAuth.getInstance().currentUser

    if (user == null) {
        onResult(false, "Please sign in first.")
        return
    }

    user.sendEmailVerification()
        .addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(
                    true,
                    "Verification email sent."
                )
            } else {
                onResult(
                    false,
                    task.exception?.localizedMessage
                        ?: "Could not send verification email."
                )
            }
        }
}

After the user opens the verification link, refresh the user state when appropriate and check isEmailVerified. If verified email is a requirement for access to sensitive features, enforce that requirement through appropriate backend checks or security rules as well as the UI.

17. Implementing Password Reset

Users sometimes forget their passwords. Firebase provides sendPasswordResetEmail() to send a password reset message to an email address.

import com.google.firebase.auth.FirebaseAuth

fun resetPassword(
    email: String,
    onResult: (Boolean, String) -> Unit
) {
    val cleanEmail = email.trim()

    if (cleanEmail.isBlank()) {
        onResult(false, "Enter your email address.")
        return
    }

    FirebaseAuth.getInstance()
        .sendPasswordResetEmail(cleanEmail)
        .addOnCompleteListener { task ->
            if (task.isSuccessful) {
                onResult(
                    true,
                    "If eligible, a password reset email will be sent."
                )
            } else {
                onResult(
                    false,
                    task.exception?.localizedMessage
                        ?: "Unable to process the request."
                )
            }
        }
}

For account privacy, consider using a generic confirmation message so the application does not reveal whether a particular email address is registered. Configure the relevant email templates and authorized domains in Firebase Console as needed.

18. Connecting Authentication with Cloud Firestore

Many applications need to store profile information, preferences, or other user-specific data. Firebase Authentication can provide the user's UID, which can be used to associate database records with the correct account.

For example, a Firestore collection might store one profile document per user:

users
  |
  +-- USER_UID_123
  |      |
  |      +-- displayName
  |      +-- email
  |      +-- createdAt
  |
  +-- USER_UID_456
         |
         +-- displayName
         +-- email
         +-- createdAt

The document IDs above are illustrative. In an application, use the actual UID from the authenticated Firebase user.

Example Firestore Security Rules

rules_version = '2';

service cloud.firestore {
  match /databases/{database}/documents {
    match /users/{userId} {
      allow read, create, update, delete:
        if request.auth != null
        && request.auth.uid == userId;
    }
  }
}

These rules allow an authenticated user to access only the profile document whose document ID matches their UID. Adapt the rules to the application's data model and validation requirements before deployment. Do not use open access rules in production.

Firebase Authentication identifies the user, while Firestore Security Rules determine whether the user may perform a database operation. Signing in alone does not automatically authorize every database request.

19. Implementing Authentication with MVVM Architecture

In a maintainable Android application, authentication logic should be separated from the user interface. Model-View-ViewModel (MVVM) is one common architecture for this purpose.

Example Repository Interface

interface AuthRepository {
    suspend fun register(
        email: String,
        password: String
    )

    suspend fun login(
        email: String,
        password: String
    )

    fun logout()

    fun currentUserId(): String?
}

The repository interface makes it easier to test ViewModels using a fake implementation. A concrete repository can wrap Firebase task APIs in Kotlin coroutines and translate SDK errors into application-specific results.

Benefits of Using MVVM

• Authentication code remains separate from screen layout code.
• Business logic can be tested independently.
• Loading and error states are easier to manage.
• Navigation logic becomes easier to maintain.
• Firebase implementation details can be replaced or mocked during testing.

20. Input Validation and Error Handling

Input validation improves usability and prevents unnecessary authentication requests. Firebase performs its own validation, but client-side validation is still useful for identifying missing or malformed input.

Important Error-Handling Practices

• Do not crash the application when an authentication task fails.
• Provide clear, user-friendly messages.
• Avoid exposing raw stack traces or internal exception details to end users.
• Log only appropriate diagnostic information.
• Do not log passwords, access tokens, or complete sensitive authentication responses.
• Disable repeated submissions while a request is in progress.
• Handle cancellation, connectivity failures, and lifecycle changes correctly.

21. Firebase Authentication Security Best Practices

Authentication security requires more than a successful login screen. Follow these practices when developing an Android application.

1. Use secure transport: Rely on Firebase SDK communication over secure connections.
2. Never store plaintext passwords: Let Firebase Authentication manage password-based authentication.
3. Protect user data: Configure Firestore, Realtime Database, and Storage security rules appropriately.
4. Validate authorization on trusted systems: Never rely only on a hidden button or client-side condition to protect sensitive operations.
5. Keep secrets out of the app: Do not embed service account keys or private backend credentials in the APK.
6. Use email verification where necessary: Require verified email addresses for workflows that need them.
7. Support account recovery: Provide a secure password reset process.
8. Apply suitable password policies: Configure the password requirements supported by Firebase Authentication.
9. Consider multi-factor authentication: Use additional verification where the risk level warrants it and the chosen Firebase configuration supports it.
10. Protect sensitive actions: Require recent authentication before certain account changes or other sensitive operations when appropriate.
11. Monitor abuse: Review authentication activity and configure suitable monitoring and abuse protections.
12. Use least privilege: Grant each user only the permissions needed for their role.

22. Common Firebase Authentication Errors

23. Testing Firebase Authentication

Testing should cover normal user flows, invalid input, network problems, session restoration, and access control.

Manual Testing Checklist

• Register a new user with valid credentials.
• Attempt registration with empty fields.
• Attempt registration with a password that violates the configured policy.
• Attempt registration using an existing account.
• Sign in using valid credentials.
• Attempt login using invalid credentials.
• Sign out and verify that the application returns to the unauthenticated state.
• Restart the application and verify the expected session behavior.
• Send a password reset email and test the recovery process.
• Send a verification email and check the verification state.
• Attempt to access another user's protected data and verify that security rules deny the request.
• Test behavior when the device loses internet connectivity.

Using Firebase Local Emulators

The Firebase Local Emulator Suite can help developers test supported Firebase services in a controlled development environment. Where appropriate, use the Authentication emulator and connect the development application to it. Keep emulator configuration separate from production configuration and never accidentally direct production users to a development backend.

Reference: Firebase Local Emulator Suite documentation.

24. Practical Project: Build a Firebase Login Application

Develop a simple Android application that allows users to register, sign in, reset passwords, verify their email addresses, and sign out.

Project Requirements

• Create a registration screen with email and password fields.
• Create a login screen with input validation.
• Connect the application to Firebase Authentication.
• Display a progress indicator during authentication requests.
• Show appropriate success and error messages.
• Implement password reset functionality.
• Provide an email verification action.
• Create a home screen for authenticated users.
• Implement logout and clear protected navigation history.
• Observe authentication state when the application opens.
• Optionally save a user profile in Cloud Firestore with rules that restrict access to the owner.

Suggested Project Structure

com.example.firebaseauth
|
+-- data
|   +-- AuthRepositoryImpl.kt
|
+-- domain
|   +-- AuthRepository.kt
|
+-- ui
|   +-- login
|   |   +-- LoginActivity.kt
|   |   +-- LoginViewModel.kt
|   |
|   +-- register
|   |   +-- RegisterActivity.kt
|   |   +-- RegisterViewModel.kt
|   |
|   +-- home
|       +-- HomeActivity.kt
|
+-- MainActivity.kt

This is a suggested structure rather than a mandatory directory layout. Jetpack Compose projects can use composable screens instead of Activities for individual screens while keeping the same separation of responsibilities.

Expected Output

• New users can create accounts.
• Registered users can sign in.
• Authentication failures are handled gracefully.
• Authenticated users can reach the protected application screen.
• Users can request password recovery and email verification.
• Signing out returns users to the appropriate unauthenticated screen.
• Database access is controlled by Firebase security rules when a database is used.

25. Best Practices for Production Applications

• Use the latest compatible Firebase SDK and follow official migration guidance.
• Use a repository and ViewModel to keep authentication logic maintainable.
• Represent loading, success, and failure states explicitly.
• Use lifecycle-aware state observation.
• Validate input on the client, while relying on Firebase and trusted backend services for authoritative checks.
• Provide accessible and understandable error messages.
• Protect database and storage resources with tested security rules.
• Use the Firebase Authentication UID to associate records with accounts.
• Configure email templates and authorized domains carefully.
• Use separate Firebase projects or clearly separated configurations for development and production when appropriate.
• Test account recovery, session restoration, and logout behavior.
• Document the authentication flow and expected security requirements.

26. Interview Questions and Answers

Q1. What is Firebase Authentication?

Firebase Authentication is a managed service that enables applications to register and authenticate users through supported identity providers, including email and password, phone authentication, and third-party sign-in methods.

Q2. What is the purpose of FirebaseAuth.getInstance()?

It obtains the Firebase Authentication instance used to perform authentication operations and inspect the current authenticated user.

Q3. Which method creates a user with an email address and password?

createUserWithEmailAndPassword() creates an account using the supplied email address and password.

Q4. Which method signs in an existing email/password user?

signInWithEmailAndPassword() submits the credentials for authentication.

Q5. What does currentUser return?

It returns the current Firebase user when a user is signed in, or null when no authenticated user is available.

Q6. How can an application observe authentication changes?

It can register a FirebaseAuth.AuthStateListener or expose authentication state through a lifecycle-aware repository or ViewModel.

Q7. How does Firebase support password recovery?

The sendPasswordResetEmail() method sends a password reset message to the specified email address when the request can be processed.

Q8. Why is email verification useful?

Email verification helps establish that a user has access to the email address associated with the account.

Q9. Does Firebase Authentication protect Firestore data automatically?

No. Firestore Security Rules must define which authenticated users can read or modify specific documents.

Q10. What is the role of the Firebase UID?

The UID uniquely identifies a Firebase Authentication user within the project and is commonly used to associate user-owned records with that account.

Q11. Why should authentication logic be separated from Activities?

Separation improves maintainability, testability, lifecycle management, and reuse across multiple screens.

Q12. Is hiding a screen enough to protect private data?

No. Data access must be enforced by Firebase Security Rules or a trusted backend. Client-side navigation alone is not a security boundary.

27. Practice Exercises

1. Create a registration screen and connect it to Firebase Authentication.
2. Implement login and logout functionality.
3. Add client-side validation for email and password fields.
4. Display a progress indicator while authentication requests are running.
5. Implement password reset functionality.
6. Add an email verification button and display the verification state.
7. Observe authentication state when the application starts.
8. Create a user profile document using the Firebase UID.
9. Write Firestore Security Rules that prevent users from accessing other users' profiles.
10. Write unit tests for a ViewModel using a fake authentication repository.

28. Quick Revision

29. Conclusion

Firebase Authentication provides Android developers with a reliable foundation for implementing user registration, login, logout, email verification, and password recovery. Its Android SDK simplifies authentication operations and allows applications to observe the current user state.

A complete implementation should combine Firebase Authentication with good input validation, lifecycle-aware state management, clear error handling, and secure authorization rules. By separating authentication logic from the user interface and testing both successful and unsuccessful workflows, developers can build Android applications that are easier to maintain and safer to use.

To learn more about Android development, explore the JustAcademy Android App Development Course, visit the JustAcademy website, or register for a course demo.